Vendor Onboarding Checklist

Where supplier intake goes wrong

Two mistakes cost the most, and both are made in the first week. The first is signing on the vendor’s standard terms before anyone has read the termination clause — so the exit gets negotiated later, from no position at all, which is how a supplier you wanted to leave gets renewed automatically. The second is granting access nobody wrote down: keys, endpoints and integrations that surface years later during an audit, or during an incident.

Both are avoidable at intake, and cheaply. The vendor offboarding checklist is the other half of this — and the last task in this one is to write that exit plan while everybody is still cooperative.

The list below is the same 50 tasks as the downloadable workbook — not a summary of it — with the function that owns each task and whether it falls before contract, during contracting, or at go-live.

1. Business Case & Sourcing

The cheapest supplier is often one you already have. Check for overlap before sourcing, then set the risk tier — because that tier decides how much diligence everything below deserves.

• Document the need and requirement Problem statement, scope, success measures, why existing options do not cover it. Business owner Before contract
• Check for overlap with existing contracts Consolidation is usually cheaper than a new agreement. Procurement Before contract
• Run competitive comparison at policy threshold Record alternatives considered and basis for selection. Procurement Before contract
• Confirm budget and approving authority Cost center, annual value, sign-off within DOA limits. Finance Before contract
• Name internal business owner and vendor account contact Accountability clear from day one. Procurement Before contract
• Assign risk tier and set diligence depth Based on data sensitivity, criticality, spend and system access — not spend alone. Security Before contract

2. Entity, Tax & Compliance Verification

Verify the entity you are actually contracting with, and collect the W-9 before the first payment rather than chasing it at year end. Sanctions screening and worker classification both belong here, not later.

• Collect Form W-9 TIN and entity type for 1099 reporting — before the first payment. Finance Before contract
• Collect W-8BEN / W-8BEN-E for foreign suppliers Treaty position and withholding determination. Finance Before contract
• Verify legal entity and good standing Contracting entity exists and matches the name on the agreement. Legal Before contract
• Run sanctions and denied-party screening OFAC and equivalent lists, including beneficial owners where required. Legal Before contract
• Verify licenses and certifications Trade, professional or sector licenses the service legally requires. Legal Before contract
• Collect certificate of insurance Coverage types and limits per contract; additional insured where agreed. Procurement Contracting
• Run financial health check for critical suppliers Solvency signals and concentration risk. Finance Before contract
• Complete worker-classification review For individuals and staffing — confirm contractor status is defensible. HR / Legal Before contract
• Obtain conflict of interest and anti-bribery attestation Related-party and employee-interest declaration. Procurement Before contract

3. Security & Privacy Due Diligence

Scale this to the tier, not to the vendor’s enthusiasm. Where you accept a risk, log it with an owner and an expiry date — an accepted risk with no expiry is a permanent one nobody revisits.

• Complete security review for the risk tier Questionnaire, SOC 2 Type II or ISO 27001, pen-test summary where production or personal data is touched. Security Before contract
• Map what data the vendor holds and where Categories, volume, hosting regions, retention, cross-border transfers. Security Before contract
• Execute the data processing agreement Review sub-processor list, breach-notification timeline, audit rights. Legal Contracting
• Confirm sector-specific obligations HIPAA BAA, PCI DSS attestation, state privacy-law terms as applicable. Legal Contracting
• Review business continuity and disaster recovery RTO and RPO commitments; what happens to your data if the vendor fails. Security Before contract
• Log accepted risks and remediation commitments With dates, owner and an expiry — not a permanent pass. Security Before contract
• Screen vendor personnel with sensitive access Background checks and confidentiality obligations flowing down to their staff. Security Contracting

4. Contract & Commercial Terms

Negotiate the exit while you still have leverage, which is now. Cap the auto-renewal, fix the notice period and secure transition assistance in the agreement, before signature rather than after.

• Paper on your MSA with a scoped SOW or order form Avoid accepting vendor standard terms unreviewed. Legal Contracting
• Define deliverables, service levels and remedies Uptime or turnaround commitments, measurement method, meaningful service credits. Legal Contracting
• Negotiate term, renewal and exit before signature Cap auto-renewal; secure notice period, transition assistance and data-return duties now. Legal Contracting
• Fix pricing, uplift caps and payment terms Rate card, annual increase ceiling, currency, invoicing cadence, net terms. Procurement Contracting
• Confirm liability, indemnity and IP ownership Caps proportionate to risk; IP in deliverables assigned; clear license scope. Legal Contracting
• Execute NDA and countersign final agreement Use the approved signature process; store executed copy in the repository. Legal Contracting
• Diary key dates immediately after signature Renewal, notice deadline, price review, certificate expiries. Procurement Contracting

5. Finance & Payment Setup

Verify bank details out-of-band, by calling a number you already held. Invoice-redirection fraud works precisely because the request arrives looking exactly like the vendor.

• Create the vendor master record Legal name, remit-to address, tax ID and payment terms from verified documents. Finance Contracting
• Verify bank details out-of-band Call a known contact on a number you already hold — never trust emailed bank details. Finance Contracting
• Raise the PO and confirm the invoicing route PO reference on every invoice, correct billing entity, AP submission address. Finance Contracting
• Set the approval and receipting workflow Who signs off invoices, evidence of delivery required, variance tolerance. Finance Contracting
• Confirm sales-tax and 1099 treatment Include nexus implications for services delivered across states. Finance Contracting
• Load the spend into budget and forecast Correct cost center and period. Finance Contracting

6. Access & Integration Provisioning

Named accounts, least privilege, MFA, and an expiry on anything temporary. Keep a register of every path granted — you cannot revoke access you never wrote down.

• Grant least-privilege access on named accounts No shared logins; enforce MFA; set an expiry on every credential. IT Go-live
• Maintain a register of every access path granted Accounts, API keys, SFTP, VPN, allowlists — so exit teardown is a single list. IT Go-live
• Build and test integrations in non-production first Confirm error handling and alerting before live data flows. IT Go-live
• Provision physical and site access only where needed Badges, visitor rules and escort requirements documented. Facilities Go-live
• Brief vendor staff on your policies Acceptable use, incident reporting, confidentiality, on-site safety. Security Go-live

7. Kickoff & Go-Live

Check the first invoice against the contract line by line. Billing errors that go unchallenged in month one tend to repeat for the whole term.

• Hold a kickoff with both teams Scope, milestones, named contacts, escalation path, meeting cadence. Business owner Go-live
• Agree the support model Coverage hours, response and resolution targets, ticket channel, after-hours escalation. Business owner Go-live
• Run a pilot or phased rollout where risk warrants Defined acceptance criteria before full deployment. Business owner Go-live
• Train internal users and publish documentation Include who to contact for what. Business owner Go-live
• Confirm the first invoice matches the contract Early billing errors tend to repeat for the whole term. Finance Go-live

8. Ongoing Governance

Set the renewal reminder before the notice deadline, so renewing is a decision rather than a default. And write the exit plan now, while everyone is still cooperative.

• Add the vendor to the third-party risk register Tier, review frequency and next diligence date. Security Go-live
• Schedule recurring reviews SLA performance, annual security re-assessment, insurance renewal, price review. Procurement Go-live
• Set the renewal reminder before the notice deadline So renewal is a decision, not a default. Procurement Go-live
• Document the exit plan at onboarding Where data lives, how it returns, who could replace this vendor tomorrow. Procurement Go-live
• Review at 90 days Confirm the vendor delivered what the business case assumed; log any gap. Business owner Go-live

Next

• Vendor Offboarding Checklist — the exit, which this checklist asks you to plan on day one.
• Employee Onboarding Checklist — the same discipline for a person rather than a supplier.
• All checklists